Allow creating Scan to initiate an attack against the target application

[ostridm]

When considering scanning for the target application, we should provide a simple and useful API to prevent users to know how our services communicate with each other. Ideally, we should hide the inter-service communication inside by introducing the Scan class.

You should make sure that the user is able to create multiple concurrent scans to speed up the flow and limit the attack surface. To hide implementation details and reduce complexities while creating an instance of Scan, you should implement a factory that will be in charge of creating scan with a particular configuration.

The ScanSettings interface should be generic and straightforward. For starters, it should include tests, a couple of parameters to optimize scanning, and info about the target application.

The crawler and other discovery methods can be easily used to set up a scan from scratch. However, in some cases, to improve the attack surface and define explicit boundaries it is better to build a HAR before starting a new scan. To address the complexity while creating HAR request, you can use the Builder or Factory pattern that helps you to hide details of how to deal with a particular kind of postData or cookies:

public class Target : TargetOptions 
{
  private Dictionary<string, string>? _headers;
  private Dictionary<string, string?> _headerValues = new Dictionary<string, string?>();
  private List<Header>? _headerParameters;
  
  public Dictionary<string, string> Headers { 
    get { 
      return _headers ?? new Dictionary<string, string>(); 
    } 
    
    private set {
      _headers = value;
      _headerValues.Clear();
      _headerParameters?.Clear();
      _headerParameters = null;
    }
  }
  
  public List<Header> HeaderParameters { 
    get { 
      if (_headerParameters.Any()) 
      {
        List<Header> headers = new List<Header>(_headers.Keys.Count);
      
        foreach(var item in _headers) {
          headers.Add(new Header {Name = item.Key, Value = item.Value});
        }
        this._headerParameters = headers;
      }
    
      return this._headerParameters ?? new List<Header>();
    }
  }
  
  // ...

  public Request ToHarRequest() {
    return new Request() {
      // ...
      Headers = _headerParameters.ToArray(),
      HeadersSize = -1,
      BodySize = -1
    };
  }
}

• Define base abstractions to manage scans #42
• Implement a single-entry HAR builder #43
• Introduce a client to manage scans via REST API #44
• Provide a default scan factory #68
• Provide a meaningful error description to the client #60
• Implement CI discovery provider #88
• Unable to retrieve a required scan factory from IoC #100
• Violating postconditions in ScanSettings #107